aboutsummaryrefslogtreecommitdiff
path: root/sys/netpfil
diff options
context:
space:
mode:
Diffstat (limited to 'sys/netpfil')
-rw-r--r--sys/netpfil/ipfilter/netinet/ip_htable.c43
-rw-r--r--sys/netpfil/ipfilter/netinet/ip_htable.h2
-rw-r--r--sys/netpfil/pf/pf_nl.c88
-rw-r--r--sys/netpfil/pf/pf_nl.h2
4 files changed, 135 insertions, 0 deletions
diff --git a/sys/netpfil/ipfilter/netinet/ip_htable.c b/sys/netpfil/ipfilter/netinet/ip_htable.c
index 3f765cfab947..5f5c04732d69 100644
--- a/sys/netpfil/ipfilter/netinet/ip_htable.c
+++ b/sys/netpfil/ipfilter/netinet/ip_htable.c
@@ -96,6 +96,8 @@ typedef struct ipf_htable_softc_s {
u_long ipf_nhtnodes[LOOKUP_POOL_SZ];
iphtable_t *ipf_htables[LOOKUP_POOL_SZ];
iphtent_t *ipf_node_explist;
+ ipftuneable_t *ipf_htable_tune;
+ u_int ipf_htable_size_max;
} ipf_htable_softc_t;
ipf_lookup_t ipf_htable_backend = {
@@ -122,6 +124,18 @@ ipf_lookup_t ipf_htable_backend = {
};
+static ipftuneable_t ipf_htable_tuneables[] = {
+ { { (void *)offsetof(ipf_htable_softc_t, ipf_htable_size_max) },
+ "htable_size_max", 1, 0x7fffffff,
+ stsizeof(ipf_htable_softc_t, ipf_htable_size_max),
+ 0, NULL, NULL },
+ { { NULL },
+ NULL, 0, 0,
+ 0,
+ 0, NULL, NULL }
+};
+
+
/* ------------------------------------------------------------------------ */
/* Function: ipf_htable_soft_create */
/* Returns: void * - NULL = failure, else pointer to local context */
@@ -142,6 +156,18 @@ ipf_htable_soft_create(ipf_main_softc_t *softc)
bzero((char *)softh, sizeof(*softh));
+ softh->ipf_htable_tune = ipf_tune_array_copy(softh,
+ sizeof(ipf_htable_tuneables),
+ ipf_htable_tuneables);
+ if (softh->ipf_htable_tune == NULL) {
+ ipf_htable_soft_destroy(softc, softh);
+ return (NULL);
+ }
+ if (ipf_tune_array_link(softc, softh->ipf_htable_tune) == -1) {
+ ipf_htable_soft_destroy(softc, softh);
+ return (NULL);
+ }
+
return (softh);
}
@@ -160,6 +186,12 @@ ipf_htable_soft_destroy(ipf_main_softc_t *softc, void *arg)
{
ipf_htable_softc_t *softh = arg;
+ if (softh->ipf_htable_tune != NULL) {
+ ipf_tune_array_unlink(softc, softh->ipf_htable_tune);
+ KFREES(softh->ipf_htable_tune, sizeof(ipf_htable_tuneables));
+ softh->ipf_htable_tune = NULL;
+ }
+
KFREE(softh);
}
@@ -179,6 +211,8 @@ ipf_htable_soft_init(ipf_main_softc_t *softc, void *arg)
bzero((char *)softh, sizeof(*softh));
+ softh->ipf_htable_size_max = IPHTABLE_MAX_SIZE;
+
return (0);
}
@@ -327,6 +361,15 @@ ipf_htable_create(ipf_main_softc_t *softc, void *arg, iplookupop_t *op)
iph->iph_name[sizeof(iph->iph_name) - 1] = '\0';
}
+ if ((iph->iph_size == 0) ||
+ (iph->iph_size > softh->ipf_htable_size_max)) {
+ IPFERROR(30027);
+ return (EINVAL);
+ }
+ if (iph->iph_size > ( SIZE_MAX / sizeof(*iph->iph_table))) {
+ IPFERROR(30028);
+ return (EINVAL);
+ }
KMALLOCS(iph->iph_table, iphtent_t **,
iph->iph_size * sizeof(*iph->iph_table));
if (iph->iph_table == NULL) {
diff --git a/sys/netpfil/ipfilter/netinet/ip_htable.h b/sys/netpfil/ipfilter/netinet/ip_htable.h
index 55c289e57ff6..3a8782ccd4b2 100644
--- a/sys/netpfil/ipfilter/netinet/ip_htable.h
+++ b/sys/netpfil/ipfilter/netinet/ip_htable.h
@@ -55,6 +55,8 @@ typedef struct iphtable_s {
char iph_name[FR_GROUPLEN]; /* hash table number */
} iphtable_t;
+#define IPHTABLE_MAX_SIZE 1024
+
/* iph_type */
#define IPHASH_LOOKUP 0
#define IPHASH_GROUPMAP 1
diff --git a/sys/netpfil/pf/pf_nl.c b/sys/netpfil/pf/pf_nl.c
index 21d4db1b8478..993981a9c0de 100644
--- a/sys/netpfil/pf/pf_nl.c
+++ b/sys/netpfil/pf/pf_nl.c
@@ -2246,6 +2246,87 @@ pf_handle_table_set_addrs(struct nlmsghdr *hdr, struct nl_pstate *npt)
return (error);
}
+static int
+nlattr_add_pfr_addr(struct nl_writer *nw, int attr, const struct pfr_addr *a)
+{
+ int off = nlattr_add_nested(nw, attr);
+ if (off == 0)
+ return (false);
+
+ nlattr_add_u32(nw, PFR_A_AF, a->pfra_af);
+ nlattr_add_u8(nw, PFR_A_NET, a->pfra_net);
+ nlattr_add_bool(nw, PFR_A_NOT, a->pfra_not);
+ nlattr_add_in6_addr(nw, PFR_A_ADDR, &a->pfra_u._pfra_ip6addr);
+
+ nlattr_set_len(nw, off);
+
+ return (true);
+}
+
+static int
+pf_handle_table_get_addrs(struct nlmsghdr *hdr, struct nl_pstate *npt)
+{
+ struct pfioc_table attrs = { 0 };
+ struct pfr_addr *pfras;
+ struct nl_writer *nw = npt->nw;
+ struct genlmsghdr *ghdr_new;
+ int size = 0;
+ int error;
+
+ PF_RULES_RLOCK_TRACKER;
+
+ error = nl_parse_nlmsg(hdr, &table_addr_parser, npt, &attrs);
+ if (error != 0)
+ return (error);
+
+ PF_RULES_RLOCK();
+ /* Get required size. */
+ error = pfr_get_addrs(&attrs.pfrio_table, NULL,
+ &size, attrs.pfrio_flags | PFR_FLAG_USERIOCTL);
+ if (error != 0) {
+ PF_RULES_RUNLOCK();
+ return (error);
+ }
+ pfras = mallocarray(size, sizeof(struct pfr_addr), M_PF,
+ M_NOWAIT | M_ZERO);
+ if (pfras == NULL) {
+ PF_RULES_RUNLOCK();
+ return (ENOMEM);
+ }
+ /* Now get the addresses. */
+ error = pfr_get_addrs(&attrs.pfrio_table, pfras,
+ &size, attrs.pfrio_flags | PFR_FLAG_USERIOCTL);
+ PF_RULES_RUNLOCK();
+ if (error != 0)
+ goto out;
+
+ for (int i = 0; i < size; i++) {
+ if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) {
+ nlmsg_abort(nw);
+ error = ENOMEM;
+ goto out;
+ }
+ ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
+ ghdr_new->cmd = PFNL_CMD_TABLE_GET_ADDR;
+ ghdr_new->version = 0;
+ ghdr_new->reserved = 0;
+
+ if (i == 0)
+ nlattr_add_u32(nw, PF_TA_ADDR_COUNT, size);
+
+ nlattr_add_pfr_addr(nw, PF_TA_ADDR, &pfras[i]);
+ if (!nlmsg_end(nw)) {
+ nlmsg_abort(nw);
+ error = ENOMEM;
+ goto out;
+ }
+ }
+
+out:
+ free(pfras, M_PF);
+ return (error);
+}
+
static const struct nlhdr_parser *all_parsers[] = {
&state_parser,
&addrule_parser,
@@ -2504,6 +2585,13 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
},
+ {
+ .cmd_num = PFNL_CMD_TABLE_GET_ADDR,
+ .cmd_name = "TABLE_GET_ADDRS",
+ .cmd_cb = pf_handle_table_get_addrs,
+ .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
+ .cmd_priv = PRIV_NETINET_PF,
+ },
};
void
diff --git a/sys/netpfil/pf/pf_nl.h b/sys/netpfil/pf/pf_nl.h
index d1538ab4ff5b..e1eb3e628df5 100644
--- a/sys/netpfil/pf/pf_nl.h
+++ b/sys/netpfil/pf/pf_nl.h
@@ -70,6 +70,7 @@ enum {
PFNL_CMD_TABLE_ADD_ADDR = 32,
PFNL_CMD_TABLE_DEL_ADDR = 33,
PFNL_CMD_TABLE_SET_ADDR = 34,
+ PFNL_CMD_TABLE_GET_ADDR = 35,
__PFNL_CMD_MAX,
};
#define PFNL_CMD_MAX (__PFNL_CMD_MAX -1)
@@ -485,6 +486,7 @@ enum pf_table_addrs_t {
PF_TA_NBR_ADDED = 4, /* u32 */
PF_TA_NBR_DELETED = 5, /* u32 */
PF_TA_NBR_CHANGED = 6, /* u32 */
+ PF_TA_ADDR_COUNT = 7, /* u32 */
};
#ifdef _KERNEL
generated by cgit v1.2.3 (git 2.25.1) at 2025-11-12 06:30:30 +0000